# PORT STANDARDIZATION — Fleet Reference

> **Created**: 2026-07-03
> **Authority**: Live SSH verification per node
> **Policy**: ALL ports are static. Firewall default policy: DROP. Only listed ports are ACCEPT.

---

## Standard Ports (Fleet-Wide)

| Port | Protocol | Service | Nodes |
|------|----------|---------|-------|
| 9922 | TCP | SSH (WG + loopback only) | ALL 8 |
| 42783 | UDP | compass (Vault auth challenge-response) | ALL 8 |
| 41820 | UDP | wg7 management mesh | Shield, Filter, Engine, Payment |
| 41652 | UDP | wg7 management mesh (alternate) | DNS, Vault |
| 44634 | UDP | wg7 management mesh (alternate) | Proxy |

## Service-to-Service Tunnel Ports

| Port | Protocol | Tunnel Name | Endpoints | Subnet |
|------|----------|-------------|-----------|--------|
| 53417 | UDP | rain | Shield ↔ Engine | 172.23.83.0/30 |
| 39847 | UDP | pebble | Shield ↔ Origin | 10.69.70.0/30 |
| 40153 | UDP | timber | Shield ↔ Origin | 10.69.71.0/30 |
| 44619 | UDP | thread | Origin ↔ Engine | 172.28.45.0/30 |
| 43291 | UDP | fossil | Origin ↔ DNS | 172.29.13.0/30 |
| 37747 | UDP | gravel | Engine ↔ DNS | 172.29.11.0/30 |
| 47417 | UDP | shale | Proxy ↔ Filter | 255.17.69.0/30 |
| 39471 | UDP | lantern | Origin ↔ Engine | 172.28.41.0/30 |
| 45247 | UDP | forge | ALL 8 nodes ↔ Engine (hub) | 172.28.50.0/28 |
| 51820 | UDP | wg10 | Shield (extended mesh) | — |

## Umbrella (Shield ↔ Engine)

| Port | Protocol | Tunnel Name | Endpoints | Subnet |
|------|----------|-------------|-----------|--------|
| 38471 | UDP | umbrella (Shield side) | Shield | 10.83.47.0/30 |
| 57196 | UDP | umbrella (Engine side) | Engine | 10.83.47.0/30 |

> ✅ Both sides now have static `ListenPort` pinned (Engine was ephemeral, pinned 2026-07-03).

## Application Ports

| Port | Protocol | Service | Node | Bind Address |
|------|----------|---------|------|-------------|
| 8301 | TCP | C++ Engine daemon (nnx) | Engine | ✅ 172.28.50.1 (forge tunnel only) |
| 8301 | TCP | Engine API (via forge) | ALL nodes → Engine | 172.28.50.0/28 only |
| 8302 | TCP | keyserv relay (socat) | Shield (10.69.69.1), Engine (10.69.69.6) | WG IP only |
| 443 | TCP | HTTPS (nginx) | Origin, Proxy | 0.0.0.0 |
| 80 | TCP | HTTP→HTTPS redirect | Origin, Proxy | 0.0.0.0 |
| 53 | TCP+UDP | DNS (PowerDNS) | DNS | 0.0.0.0 |

---

## Per-Node Port Map

### Filter (333941) — 10.69.69.4
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 41820 | UDP | wg7 management mesh | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Verified 2026-07-03 |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

### Payment (714820) — 10.69.69.7
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 41820 | UDP | wg7 management mesh | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Verified |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

### Vault (869377) — 10.69.69.8
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified 2026-07-03 |
| 41652 | UDP | wg7 management mesh | ✅ Verified 2026-07-03 |
| 42783 | UDP | compass (Vault auth hub) | ✅ Verified 2026-07-03 |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

### DNS (199335) — 10.69.69.5
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 41652 | UDP | wg7 management mesh | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Added 2026-07-03 |
| 37747 | UDP | gravel (Engine↔DNS) | ✅ Verified |
| 43291 | UDP | fossil (Origin↔DNS) | ✅ Verified |
| 53 | TCP+UDP | DNS (PowerDNS) | ✅ Verified |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| 22 | TCP | SSH (legacy) | 🚫 DENY rule in place |
| **Default** | **—** | **DENY (incoming)** | ✅ UFW default deny |

### Proxy (244939) — 10.69.69.3
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 44634 | UDP | wg7 management mesh | ✅ Verified |
| 47417 | UDP | shale (Proxy↔Filter) | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Verified |
| 443 | TCP | HTTPS (nginx reverse proxy) | ✅ Verified |
| 80 | TCP | HTTP→HTTPS redirect | ✅ Verified |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

### Origin (558201) — 10.69.69.2
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 41820 | UDP | wg7 management mesh | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Verified |
| 43291 | UDP | fossil (Origin↔DNS) | ✅ Verified |
| 39471 | UDP | lantern (Origin↔Engine) | ✅ Verified |
| 39847 | UDP | pebble (Shield↔Origin) | ✅ Verified |
| 44619 | UDP | thread (Origin↔Engine) | ✅ Verified |
| 40153 | UDP | timber (Shield↔Origin) | ✅ Verified |
| 443 | TCP | HTTPS (nginx + web app) | ✅ Verified |
| 80 | TCP | HTTP→HTTPS redirect | ✅ Verified |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

### Shield (414342) — 10.69.69.1
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 41820 | UDP | wg7 management mesh | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Verified |
| 53417 | UDP | rain (Shield↔Engine) | ✅ Verified |
| 38471 | UDP | umbrella (Shield↔Engine) | ✅ Verified |
| 51820 | UDP | wg10 (extended mesh) | ✅ Verified |
| 39847 | UDP | pebble (Shield↔Origin) | ✅ Verified |
| 40153 | UDP | timber (Shield↔Origin) | ✅ Verified |
| 45247 | UDP | forge (SCLS telemetry) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

### Engine (669427) — 10.69.69.6
| Port | Proto | Service | Status |
|------|-------|---------|--------|
| 9922 | TCP | SSH (WG + loopback) | ✅ Verified |
| 41820 | UDP | wg7 management mesh | ✅ Verified |
| 42783 | UDP | compass (Vault auth) | ✅ Verified |
| 44619 | UDP | thread (Origin↔Engine) | ✅ Verified |
| 53287 | UDP | gravel (Engine↔DNS) | ✅ PINNED 2026-07-03 (was ephemeral) |
| 57196 | UDP | umbrella (Shield↔Engine) | ✅ PINNED 2026-07-03 (was ephemeral) |
| 57417 | UDP | rain (Shield↔Engine) | ✅ Verified |
| 41938 | UDP | lantern (Origin↔Engine) | ✅ Verified |
| 8301 | TCP | C++ Engine daemon (nnx) | ✅ Bound 172.28.50.1 (forge tunnel only) |
| 8302 | TCP | keyserv relay (socat) | ✅ Bound 10.69.69.6 only |
| 45247 | UDP | forge (SCLS telemetry hub) | ✅ DEPLOYED 2026-07-04 |
| **Default** | **—** | **DROP** | ✅ firewalld zone=drop |

---

## Cross-References

| Document | What It Tells You |
|----------|-------------------|
| [ENGINE_STANDARDIZATION.md](ENGINE_STANDARDIZATION.md) | C++ daemon architecture, HMAC protocol, trust scoring, vault cipher |
| [TOOLING_STANDARDIZATION.md](TOOLING_STANDARDIZATION.md) | Bash tools, decrypt pipeline, TOOL_ID→disguised name mapping |
| [WIREGUARD_MAP.md](WIREGUARD_MAP.md) | Tunnel topology, subnet assignments, compass/lantern/rain details |
| [PERMISSIONS_STANDARDIZATION.md](PERMISSIONS_STANDARDIZATION.md) | File ownership, SELinux, shadow immutability |

### Port → Communication Flow

```
Port 8301 (Engine API) — UPDATED 2026-07-04:
  ← SCLS audit_logger.sh (via forge tunnel 172.28.50.x, fallback wg7)
  ← PHP Dashboard (via lantern tunnel 172.28.41.x)
  ← Bash se_client.sh (via wg7 mesh 10.69.69.x)
  → Documented in: ENGINE_STANDARDIZATION.md (HMAC protocol + API endpoints)

Port 45247 (forge):
  ← All 8 nodes → Engine (SCLS encrypted audit telemetry)
  → Documented in: PORT_STANDARDIZATION.md, DATABASE_STANDARDIZATION.md

Port 9922 (SSH):
  ← admin@gabriella (service/tooling)
  ← administrator@ppk (owner login)
  → Documented in: rules.md NET-05, TOOLING_STANDARDIZATION.md (session gate)

Port 42783 (compass):
  ← All nodes → Vault (credential challenge-response)
  → Documented in: WIREGUARD_MAP.md, TOOLING_STANDARDIZATION.md (decrypt-run.sh key fetch)
```

---

## Firewall Audit Results (2026-07-04)

### Stale Ports Cleaned (2026-07-04)

> ✅ All stale ports addressed in per-node firewall scripts deployed 2026-07-04.
> Scripts: `firewall_<node>.sh` in each node's `tooling/raw/` directory.

| Node | Port | Was | Action |
|------|------|-----|--------|
| Proxy (244939) | 30222/tcp | Old SSH | `firewall-cmd --zone=public --remove-port=30222/tcp --permanent` |
| Proxy (244939) | 33022/tcp | Old SSH | `firewall-cmd --zone=public --remove-port=33022/tcp --permanent` |
| Proxy (244939) | 39847/udp | pebble (migrated to Shield) | Remove from Proxy firewall |
| Proxy (244939) | 40153/udp | timber (migrated to Shield) | Remove from Proxy firewall |
| Proxy (244939) | 49616/udp | Old shale port (retired) | Remove from Proxy firewall |
| Origin (558201) | 33022/tcp | Old SSH | Remove port + rich rule |
| Shield (414342) | 33022/tcp | Old SSH rich rule | Remove rich rule |

### Verified Port Assignments (Live)

All nodes confirmed default zone `drop` with SSH on WG+loopback (9922) only.
All WireGuard tunnel ports match WIREGUARD_MAP v3.2 assignments.
compass tunnel (42783) verified on 8/8 nodes.
forge tunnel (45247) deployed on 8/8 nodes — 2026-07-04.
Per-node firewall scripts deployed: `firewall_<node>.sh` — 2026-07-04.